topic Re: Harmony Endpoint <> Mozilla Thunderbird in Endpoint

Harmony Endpoint <> Mozilla Thunderbird

IZoom — Thu, 25 Mar 2021 13:47:36 GMT

Hi guys,

I have issue - when I install endpoint (recommended / latest) and run Thunderbird on various windows versions, epam_svc.exe uses 25-60% CPU while Thunderbird not responding.

defined exclusion to Anti-Malware on access scan for "C:\users\*\AppData\Roaming\Thunderbird\Profiles\" (
https://wiki.mozilla.org/Thunderbird:Testing:Antivirus_Related_Performance_Issues)
The Thunderbird profile is not huge - ~20 GB, 622 files
internal log viewer shows nothing (not literally)
sysinternals procemon points lot of EPMA_SVC pointing to thunderbird profiles even the exclusion is set
windows various versions (from 7 till 10 enterprise latest build, fully patched)
cpda.log does not show unusual activity.
AntimalwareBlade.log some strange messages:
[warni] Unhandled callback event EVENT_MAILBASE [AMEngine::Kav::KavScanner::KavCallbackMethod], nothing else unusual

Do you have it working / tested with Thunderbird?

Re: Harmony Endpoint <> Mozilla Thunderbird

PhoneBoy — Sun, 28 Mar 2021 03:01:45 GMT

I would open a TAC case here.

Re: Harmony Endpoint <> Mozilla Thunderbird

IZoom — Mon, 29 Mar 2021 06:54:46 GMT

Thanks man. I'll keep you posted about solution

Re: Harmony Endpoint <> Mozilla Thunderbird

IZoom — Thu, 01 Apr 2021 09:12:31 GMT

This helps: excluded from AntiMalware - on access - scan mail messages.

We are trying to isolate problem now with removing previous generic exclusions and define new in AntiMalware blade only for thunderbird.exe process.

I'll keep you posted.

Re: Harmony Endpoint <> Mozilla Thunderbird

MikeB — Thu, 01 Apr 2021 19:22:12 GMT

thank you for sharing this information. It helps a lot

Re: Harmony Endpoint <> Mozilla Thunderbird

HSPPA — Tue, 01 Jun 2021 08:58:46 GMT

Please, take into consideration these additional notes:

Thunderbird "Deleted Items" folder is corrupted after the endpoint installation.
Thunderbird "Sent Items" folder, is corrupted also.

Re: Harmony Endpoint <> Mozilla Thunderbird

stl — Wed, 16 Jun 2021 09:35:38 GMT

I have the same problem - how can I exclude "scan mail messages" in cloud-based Harmony Endpoint -> Policy - > Threat Prevention -> Exclusion Center?

There is no "AntiMalware - on access - scan mail messages". I can exclude process (like thunderbird.exe) only.

Regards

Chris

Re: Harmony Endpoint <> Mozilla Thunderbird

jgarcias — Thu, 18 Nov 2021 13:43:53 GMT

Hello,

Same problem here.

Did you solved the issue or still using the workaround of disabling scan mail messages?

Thanks

Re: Harmony Endpoint <> Mozilla Thunderbird

stl — Thu, 18 Nov 2021 13:55:49 GMT

I'd exluded process "thunderbird.exe" in this setting:

Scan all files upon access .. -> Add Location -> Process Name (full path to thunderbird.exe)

Re: Harmony Endpoint <> Mozilla Thunderbird

jgarcias — Thu, 18 Nov 2021 13:58:28 GMT

Hello,

OK, I wouldn't like to exclude the whole process so I think I'm going to open a TAC case to check it...

Thanks

Re: Harmony Endpoint <> Mozilla Thunderbird

stl — Thu, 18 Nov 2021 14:07:38 GMT

Please let me (and us 😉) know, what they proposed/did.

Re: Harmony Endpoint <> Mozilla Thunderbird

IZoom — Thu, 18 Nov 2021 14:27:17 GMT

I had opened TAC. Result was in Thread prevention -> Exclussion center -> Exclussion settings - > Process exclussion (on-access only) -> thunderbird.exe

Re: Harmony Endpoint <> Mozilla Thunderbird

jgarcias — Thu, 18 Nov 2021 14:37:57 GMT

So the solution from the TAC was exclude "thunderbird.exe" from being analyzed? It seems a workaround....

Did they tell you if in a future release could fix the problem to not exclude it from protections?

Re: Harmony Endpoint <> Mozilla Thunderbird

IZoom — Thu, 18 Nov 2021 14:50:00 GMT

correct, this was answer from TAC. Yes, they did tell me they don't plan to fix it for the future releases as this is known bug of thunderbird, which is minor email client. Many other vendors fixed it by default exception not visible to admins.

the security is not broken too much as the mails are scanned on network level and the attachments are scanned on touch. Just the core thunderbird.exe is excluded.

Re: Harmony Endpoint <> Mozilla Thunderbird

jgarcias — Thu, 18 Nov 2021 14:52:29 GMT

OK, thanks for your answer